NULL Pointer Dereference in QNAP Operating System

CVE-2025-52860

What is CVE-2025-52860?

A NULL pointer dereference vulnerability has been discovered within various versions of the QNAP operating system. This flaw allows a remote attacker, once authenticated as an administrator, to exploit the vulnerability and potentially execute a denial-of-service (DoS) attack. It is crucial for users to ensure they are running QTS version 5.2.6.3195 build 20250715 or later, along with QuTS hero version 5.2.6.3195 build 20250715 or later, as these versions contain fixes for the identified vulnerability.

References